pixman_trapezoid_valid(): Fix underflow when bottom is close to MIN_INT

If t->bottom is close to MIN_INT (probably invalid value), subtracting
top can lead to underflow which causes crashes.  Attached patch will
fix the issue.

This fixes bug 67484.

diff --git a/pixman/pixman.h b/pixman/pixman.h
index 7ff9fb52a1ae48da0963a47a1bdb52f41d829a66..509ba5e534a80e285b308dae7cfc8ff3f3d3ce15 100644 (file)
--- a/pixman/pixman.h
+++ b/pixman/pixman.h
@@ -1030,7 +1030,7 @@ struct pixman_triangle
 #define pixman_trapezoid_valid(t)                                 \
     ((t)->left.p1.y != (t)->left.p2.y &&                          \
      (t)->right.p1.y != (t)->right.p2.y &&                        \
-     (int) ((t)->bottom - (t)->top) > 0)
+     ((t)->bottom > (t)->top))
 
 struct pixman_span_fix
 {